Coherent State Quantum Key Distribution Without Random Basis Switching 
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The random switching of measurement bases is commonly assumed to be a necessary step of quantum key 
distribution protocols. In this paper we show that switching is not required for coherent state continuous variable 
quantum key distribution. We show this via the no-switching protocol which results in higher information 
rates and a simpler experimental setup. We propose an optimal eavesdropping attack against this protocol, for 
individual Gaussian attacks, and we investigate and compare the no- switching protocol applied to the original 
BB84 scheme. 
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I. INTRODUCTION 

Quantum key distribution (QKD) CI S 0] allows two peo- 
ple, Alice and Bob, to communicate in secret, where the laws 
of quantum physics insure the total privacy of their communi- 
cation. A secret key is generated by Alice transmitting quan- 
tum states to Bob, who performs measurements on the re- 
ceived states. An eavesdropper. Eve, who actively attacks the 
quantum channel, will disturb the quantum system and hence 
be detected. A passive eavesdropper, however, whose attack 
simulates the quantum channel will remain undetected, but 
the maximum information obtainable by this attack is known 
and can be bounded. Additionally Eve cannot intercept and 
perfectly copy the quantum states as a consequence of the no- 
cloning theorem of quantum information |4|] . After they have 
distilled a secret key, Alice and Bob can use this key to com- 
municate secret information over a classical communication 
channel. 

The first QKD protocol, known as the BB84 protocol, uses 
single randomly polarized photon states |2]. Here Alice pre- 
pares and sends a random ensemble of single photon states 
over a quantum channel to Bob. Bob then measures the states 
by randomly switching between two non-commuting mea- 
surement bases - a compulsory step to insure the security of 
the protocol. Any loss to the environment or noise on the 
channel is attributed to Eve, who is only limited in her attack 
by the laws of physics. Later Alice and Bob produce a sifted 
key by discarding results where their bases are not the same. 
Alice and Bob then release a part of their raw key to test for 
channel transmission and errors in their correlated bit string. 
Reconciliation protocols [5J are employed in order to correct 
any errors between Alice and Bob's correlated key. Finally 
privacy amplification is used to reduce Eve's knowledge 
of the key to a negligible amount. Once a secret key has been 
generated it is used as a one-time pad |7] to encrypt the mes- 
sage. The absolute security of the BB84 protocol has been 
proven in Other single photon schemes proposed 

include the EPR protocol lU] and the B92 protocol 11211 . 

QKD using continuous variables was introduced in 1999 
fl3] as an alternative to the original single photon schemes. 
Continuous variable Hill QKD offer the advantages of higher 
detection efficiencies, compatibility with current technologies 



and faster communication speeds. In 2000, continuous vari- 
able QKD using squeezed states [ IS] and EPR correlations 
flol were proposed. Further work included using squeezed 
fli^ and coherent states fW] that generated Gaussian keys 
against individual Gaussian attacks. All of these protocols 
were originally only thought to be secure for line losses less 
than 50% or 3dB of noise. However, it has been shown that 
this limit can be overcome by using either reverse reconcilia- 
tion 1 19] or post-selection |20] techniques. Reverse reconcili- 
ation involves Alice (and Eve) estimating what states Bob has 
measured rather than the usual way of Bob (and Eve) trying 
to determine what states Alice has sent. In this sense the flow 
of classical information is in the reverse direction. The sec- 
ond protocol, post-selection, can also tolerate higher losses 
by Alice and Bob carefully selecting information for which 
they have an advantage over Eve. The unconditional security 
of continuous variable QKD has been proven for squeezed 
state protocols |21] and Gaussian modulated coherent states 
using homodyne detection I22I1 . Collective attacks using re- 
verse reconciliation and their unconditional security was also 
discussed in 1 23.1 . Continuous variable QKD has also been 
experimentally demonstrated in QI^HS- 

The random switching of measurement bases by Bob has 
been a fundamental step in QKD protocols using both sin- 
gle photon states and continuous variables. However recently 
we introduced a new coherent state continuous variable QKD 
protocol, against individual Gaussian attacks, that does not 
require switching. This new protocol, known as the no- 
switching protocol, involves Bob measuring both bases simul- 
taneously. This was shown to offer higher information rates 
along with a simpler experimental setup than protocols that 
use switching |27]. Since then the no- switching protocol has 
lead to various research, both theoretical |3 and exper- 
imental 1 261. It was also shown in [231 to be secure against 
collective eavesdropping attacks. In this paper we will expand 
on our analysis of the no-switching protocol and consider a 
more thorough eavesdropping attack. We will also discuss an 
equivalent no- switching protocol for discrete variables, in par- 
ticular the BB84 protocol. 

This paper is organized as follows. In Section II we discuss 
the no- switching protocol for coherent state continuous vari- 
able QKD. Section III discusses and compares two physical 
realizations of possible eavesdropping attacks. In Section IV 
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we discuss an equivalent no-switching protocol for discrete 
variables. Section V concludes. 



II. THE NO-SWITCHING PROTOCOL 
A. Notation 

Before leading into the steps of the no-switching protocol 
we will first briefly discuss the nomenclature used throughout 
this paper. Quantum states that we consider in this paper can 
be described using the state vector notation \a). These quan- 
tum states can be described using the boson field annihilation 
operator d which can be expressed in terms of the quadrature 
field operators as 



■iX-) 



(1) 



where X+ and X~ are the amplitude (+) and phase (-) quadra- 
ture operators respectively. The annihilation operator is not 
measurable in itself as it is non-Hermitian. However, we can 
express the real and imaginary parts of Eq.([l]) as 



X- 



i{d'^ — d) 



(2) 
(3) 



which are Hermitian and therefore measurable. These oper- 
ators can be expressed in terms of a steady state and a fluc- 
tuating component as = (X^) + 5X^ with quadrature 
variances defined as = {{SX^)'^). In this paper all op- 
erators representing the amplitude and phase observables are 
denoted by a hat symbol. 



to Bob through a quantum channel with a channel transmis- 
sion efficiency r]. The losses in the channel couples in chan- 
nel noise, which have corresponding quadrature operators de- 
noted as X^ (and with corresponding quadrature variances 
V^). Therefore the states that arrive at Bob's station can be 
described by the quadrature operators and corresponding vari- 
ances 



F± = vV^ + (1 - v)V^ 



(6) 
(7) 



where the superscript ' indicates states entering Bob's sta- 
tion. Once Bob receives these states he does not randomly 
switch between measurement quadratures, instead he simul- 
taneously measures both the amplitude and phase quadratures 
of the state via a 50/50 beamsplitter and a pair of homodyne 
detectors. We denote Bob's quadrature measurements by X^ 
with a quadrature variance of , which can be expressed as 
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= 



1 

71 
1 

2 



(1 



!)• 



(8) 
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where is the vacuum noise entering into Bob's 50/50 



Alice 
J" 



Bob 







' quantum channel 








^1 




= 

x:. 


V _B_ 



>x; 



B. No-Switching Protocol 

In the original coherent state QKD protocols [3» Al- 
ice first prepares a displaced vacuum state that will be sent to 
Bob. This is achieved by choosing two real random numbers 
5+ and S~ from a Gaussian probability distribution with zero 
mean (5^) = and a variance of = ((5^)^). She then 
displaces the amplitude and phase quadratures of the coherent 
state by 5+ and S~ respectively. The displaced coherent state 
can be represented by the state vector \S~^ + iS~). This state 
has corresponding operators X^ associated with the ampli- 
tude and phase observables of the quantum state. So typically 
we can express these operators and corresponding quadrature 
variances as 

X± = 5±+7V± (4) 
= Vi^l (5) 

where is the operator associated with the amplitude and 
phase of the initial vacuum state |0), which has a normalized 
variance ((7V^)^) = 1. Alice transmits this coherent state 



FIG. 1: Schematic of a coherent state continuous variable QKD 
scheme using the no-switching protocol. AM: amplitude modulator, 
PM: phase modulator; S^: random Gaussian numbers; X^: Alice's 
prepared state; 77: channel transmission; X^: channel noise; X^,: 
describes the states entering Bob's station; : Bob's vacuum noise; 
Xb- describes the states Bob measures after the beamsplitter. 

beamsplitter with a variance {{N^)'^) ~ ^- Figure [l] gives a 
schematic of the no-switching coherent state QKD protocol. 
As a point of interest it has been shown |29] that simultane- 
ously measuring both quadratures is equivalent to an optimal 
quantum doner for continuous variable Gaussian states, i.e. 
a cloning machine that produces two quantum clones with an 
optimal fidelity of JT = 2/3. So the no-switching protocol can 
also be thought of as an optimal cloning protocol where Bob 
(and, as we shall see. Eve) optimally clones their respective 
quantum states. 

A consequence of the no- switching protocol is that vacuum 
noise is introduced into Bob's measurements via the 50/50 
beamsplitter at his station. In the following sections we an- 
alyze the effect of this extra quanta of noise introduced into 
Bob's quadrature measurements in terms of secret key rate 
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and the overall security of the protocol. We will show that it 
is still secure against individual attacks and it results in higher 
information rates as a result of obtaining two simultaneous 
streams of information from both quadratures, instead of the 
usual one quadrature measurement. 



C. Mutual Information 

In analyzing QKD protocols we are inevitably concerned 
with the net mutual information 03 mil between Alice and 
Bob in the presence of Eve, i.e. the rate at which a secret key 
can be generated by Alice and Bob. In this paper we consider 
that Alice and Bob use the reverse reconciliation protocol to 
generate a secret key Ol- For the reverse reconciliation pro- 
tocol the net information rate can be written as 

AI = I{B : A) - I{B : E) (10) 

where I{B : A) is the mutual information between Bob and 
Alice and similarly between Bob and Eve, I{B : E). We can 
define these quantities as 

I{B:A) = H{B) - H{B\A) (11) 
I{B:E) = H{B) - H{B\E) (12) 

where H{B) is Bob's Shannon entropy and H{B\A) and 
H{B\E) are Alice's and Eve's conditional entropies relative 
to Bob's measurement |31] respectively. The conditional en- 
tropy is a measure of how uncertain Alice and Eve are, on av- 
erage, about Bob's measurement result. These quantities can 
physically be thought of as noise, due to the quantum chan- 
nel and the intrinsic quantum noise of Alice's state. For the 
no-switching protocol, Alice encodes independent informa- 
tion onto both quadratures of a coherent state, which Bob then 
simultaneously measures. Subsequently we can describe the 
mutual information rate between Alice and Bob as the sum of 
the quadrature information rates as 

AI = A/+ + Ar (13) 

where A/+ is the information rate for the amplitude quadra- 
ture and A/~ the information rate for the phase quadrature. 
By substituting Eqs. (II 1112b into Ea.iTOll and assuming sym- 
metry for both quadratures, we end up with the information 
rate for the no- switching protocol given by 

AI = 2[H{B\E) - H{B\A)] (14) 

Hence, in order to determine the final information rate, we 
need to determine both Alice's and Eve's conditional en- 
tropies. 



D. Conditional Variances 

We can express Alice's and Eve's conditional entropies of 
Bob's quadrature measurements in terms of conditional vari- 



ances 

H{B\A) = hog^iVAiB) (15) 

H{B\E) = hog^iVEiB) (16) 

where Va\b and Ve\b are Alice's and Eve's conditional vari- 
ances relative to Bob's measurement respectively |32]. The 
conditional variance can be thought of as the uncertainty in 
Alice's and Eve's estimates of Bob's quadrature measurement 
result. In general the conditional variance of X given the event 
Y can be written as 

VxiY = var{X\Y) = mm{{Y - gXf) (17) 

9 

where g is an optimal gain that minimizes the conditional 
variance. Therefore, the total information rate for the no- 
switching protocol given in Eq.iO, assuming symmetry of 
both quadratures, can be written in a simpler form in terms of 
conditional variances as 



E. Alice's Conditional Variance 

For the no- switching protocol Alice's conditional variance 
of Bob's measurements is defined as 

y4% = min{(l|-5|5±)2) (19) 

9 A 

where is Bob's quadrature measurement given by Eq. 
5^ is the quadrature displacement of Alice's prepared state 
and is an experimental gain or Alice's best estimate at what 
Bob has measured. This gain is then optimized to give a min- 
imum conditional variance. The minimum gain is given by 
g^ = (5±X|)/(5±^) which is then substituted into Eq. (HI 
to give a conditional variance of 

We now calculate Alice's conditional variances for the no- 
switching protocol. To calculate the conditional variances we 
consider a more general protocol, where Alice can transmit 
to Bob displaced squeezed states instead of coherent states. 
This scenario leads to the best possible correlation between 
Alice and Bob for a particular quadrature measurement. In 
this case, the quadrature variance of the states prepared by Al- 
ice are given by 

= Vi + (21) 

where V^^ is the quadrature variance of the squeezed states 
prepared by Alice. To ensure that the quadrature variances 
of Alice's transmitted state remains symmetric with variances 
y^, we require that the maximum amount of squeezing is 
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limited by the variance of Alice's transmitted states. This is 
given by the following inequality 

1 



Substituting Eq.© into Eq.(|20|), with {S^X^) = ^ 
we can calculate Alice's conditional variance to be 



lb-- 



± 
sqz 



+ (1 - v)V^ + 1 



(22) 



(23) 



V,% from 



where we have used the fact that = 
Eq.(l2Tl. We point out that in the no-switching protocol Al- 
ice does not actually use squeezed states but rather coherent 
states. So eventually we will set V^^ = 1. We only con- 
sider that Alice uses squeezing for our analysis in order to 
give lower bounds for the quadrature conditional variances. 



F. Uncertainty Relations 

Before we explicitly calculate Eve's conditional variance 
we first derive a general relationship between Alice's and 
Eve's conditional variances. We will then use this relation to 
bound Eve's minimum conditional variance and hence Eve's 
maximum mutual information with Bob. To calculate a rela- 
tionship between Alice's and Eve's conditional variances of 
Bob's measurement, and V^^, we define the operators 
that denote Alice's and Eve's inference of Bob's measurement 
before his beamsplitter, expressed as 



^E\B' 
^A\B' 



--XI, 



(24) 
(25) 



where g^X^ and g^S^ are Alice's and Eve's optimal esti- 
mates with optimal gains, g^ and g^. Finding the commuta- 
tor of the above two equations, and using the fact that different 
Hilbert spaces commute, we find that 



(26) 



This leads to | 33] the joint Heisenberg uncertainty relation 

VilE'VliB' > 1 (27) 

Therefore, there is a limit to what Alice and Eve can know 
simultaneously about what Bob has measured. Once again an 
important notational point is the superscript ^ Whenever this 
is used it implies that the equations are only dealing with the 
states before Bob's beamsplitter. From the above inequality 
it is possible to determine the maximum information Eve can 
obtain about the state in terms of Alice's conditional variances 



V 



variance, we first consider her inference of Bob's state prior 
to the 50/50 beamsplitter in Bob's station. As with Alice's 
conditional variance. Eve's conditional variance is given by 



=min((X|,-^^±X|)^) 



(28) 



9e 



where X^, (defined in Eq. (l32l) ) is the quadrature of Bob's 
state that could be measured prior to the beamsplitter and the 
associated gain g^. Eve's measurement variance after the 
beamsplitter conditioned on Bob's measurement (V^^) can 
be expressed in terms of the conditional variance before the 
beamsplitter (V^^,) as 



1((X|-V2,±X|) 



xi 




viiB' 



(29) 



where we have used the fact that Eve has no access to the 
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FIG. 2: (a) Net information rates for the no- switching (i) and switch- 
ing (ii) protocols as a function of channel efficiency; where = 1 
and — 100. Two eavesdropping attacks are given by the same 
solid curve (iii). (b) Contour plot of the information rate for the no- 
switching protocol as a function of channel efficiency and channel 



G. Eve's Conditional Variance 

We now calculate Eve's minimum conditional variance for 
an attack which is only limited by the joint Heisenberg uncer- 
tainty relation given in Eq. (l27b and Alice's conditional vari- 
ance in Eq. (l23t . To find a lower bound on Eve's conditional 



beamsplitter in Bob's station, and therefore has no knowledge 
of the vacuum entering through it. The uncertainty relation 
Eq.iIZTI) tells us that there is a limit to what Alice and Eve 
can simultaneously know about what Bob has measured, i.e. 

can now determine Alice's conditional 

h/\B A\B 
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variance of Bob, if Bob were to directly measure a single 
quadrature of his state before the 50/50 beamsplitter V^g, . 

The derivation of V^g/ is based on the derivation given in 
iHqIi which goes as follows. We can use Eq.(l2Ql with the fol- 
lowing equations 



5± 




(30) 




^ A ^ sqz 


(31) 






(32) 




= vV} + (1 - 7?)y± 


(33) 




= Vvvi 


(34) 



The above equations are the same as the no- switching equa- 
tions, e.g. Eqs. (l8l9l) , except for the 1 / >/2 and that are due 
to Bob's simultaneous quadrature measurements. Alice's con- 
ditional variance using reverse reconciliation with switching is 
given by 

Kb' ^ V^\B'^,^ = (^/^f + (1 - ^)Vn ) (35) 

Using this minimum value with Eq.dZTll we can calculate 
Eve's conditional variance when switching is used 

> + (1 - (36) 

Again we emphasize that we have assumed that Eve can si- 
multaneously measure both the amplitude and phase quadra- 
tures of her ancilla (or measuring) state without paying a 
"quantum duty". This is in fact an unphysical assumption that 
allows Eve more information than what she is entitled to. We 
calculate a lower bound on Eve's conditional variance for the 
no-switching protocol by substituting Eq. (|3SI) into Eq. (l29b 

^e1b>^((^ + (1-^)^n)'' + i)- (37) 
H. Secret Key Rate 



dashed line) of fl?]. Figure|2lshows that the no- switching pro- 
tocol has a higher information rate than the switching protocol 
for all channel transmission losses. 

We now turn our attention to physical implementations of 
eavesdropping attacks against the no- switching protocol and 
compare these attacks to the bound derived in Eq. (l38t . 



III. EAVESDROPPING ATTACK 

In the previous section we derived an upper bound on Eve's 
maximum information for the the no- switching protocol. In 
this section we put a lower bound on Eve's information by in- 
vestigating a physical eavesdropping attack. A feed-forward 
scheme was discussed in 1 27] as a possible eavesdropping at- 
tack to the no- switching protocol for varying channel noise 
(i.e. not just vacuum noise). Here Eve used a beamsplitter 
to gather information from the quantum channel (see Fig.|3t). 
She then measured both quadratures simultaneously and then 
feed forward these altered states onto Bob. We denote this 
attack as the coherent feed-forward attack. We will now con- 
sider a more sophisticated attack that incorporates additional 
entanglement. We show that by giving Eve additional re- 
sources, e.g. the use of entanglement, that she gets no ad- 
ditional information compared to the coherent feed-forward 
attack. We then discuss reasons for thinking that the coherent 
feed-forward attack might be optimal for individual Gaussian 
attacks. 



A. Entanglement Feed-Forward Attack 

Figure |3j) shows a schematic of the entanglement feed- 
forward attack. This attack goes as follows: Eve creates two 
Einstein-Podolsky-Rosen (EPR) ll34|] entangled beams by in- 
terfering two squeezed beams Xf^^-^ and Xf^^2 ^ 50/50 
beamsplitter. The quadratures of the entangled beams are de- 
scribed by the following operators 



We can now determine the final secret key rate for the 
no-switching protocol by substituting Alice's and Eve's con- 
ditional variances from Eqs. (l23l ITtI (and symmetrize both 
quadratures) into Eg.dTsl. The final secret key rate is then 
given by 



AI > log2 



(l-^)^iv) 



7?+(l-7/)VAr + l 



(38) 



where we have set = 1 to indicate that we are using 
coherent states. Figure[5tb) shows a plot of Eq. (l38b for vary- 
ing channel transmissions and varying channel noise. We see 
that it is completely secure for vacuum noise and as the noise 
is increased the insecure region gets larger (as is the case for 
all QKD protocols). Figure |3a) plots the information rate 
of Eq. (|38|) (for = I and = 100) against the chan- 
nel transmission (dashed line). We can now compare the no- 
switching protocol (dashed line) to the switching protocol (dot 



eprl 



X. 



epr2 



^(X± 



X 



sqz2 ) 



X 



sqz2 ) 



(39) 
(40) 



Eve retains the second of the entangled beams X^^2' which 
she simultaneously measures both quadratures via a 50/50 
beamsplitter and two perfect homodyne detectors. We assume 
that Eve has quantum memory and that she performs these 
measurements only after Bob has receives the states. These re- 
sulting quadrature operators and corresponding variances are 
given by 



± 

El 



V, 



sqzl ~^ 



V2 

sqz2 + 2) 



El 



(41) 
(42) 
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FIG. 3: Schematic of two possible eavesdropping attacks: (a) Coher- 
ent feed-forward attack and (b) entanglement feed-forward attack. 



where N^-^ is the vacuum noise entering into Eve's first beam- 
splitter with {{N^i)'^) = 1. Eve then injects the entangled 
beam X^^^ into a beamsplitter with a transmission efficiency 
e to simulate channel losses. Eve then simultaneously mea- 
sures both quadratures of the output beam of the beamsplit- 
ter, with quadrature operators and corresponding variances ex- 
pressed as 



X 



E2 



2 



E2 \ 



E2 



((1 - ^)yA + 2(^««.i + K^2) + l)/2 (43) 



where the vacuum noise entering into Eve's second 

beamsplitter with = 1- Using lossless electro- 

optic feed-forward techniques, Eve transfers the measured 
photocurrents back onto the quantum channel with some gain 
g^. The gain of this feed-forward must be chosen to en- 
sure that the magnitude of the signal detected by Bob re- 
mains invariant. So for an arbitrary channel transmission 77, 



Bob would be expecting a signal described by the quadra- 
ture operator X^ due to losses in the quantum chan- 
nel. Now Eve knows that she is sending Bob a signal of 
+ ^1 ^"(1 - e)/2 X^. Therefore she wants X^ 



to equal ^/e X^ 
of 



e)/2 X^. This leads to a gain 



(44) 



We point out that this is the same gain as given for the coher- 
ent feed-forward attack fxf] . Now because Eve has reduced 
the transmission of the quantum channel, she will need to add 
additional Gaussian noise (with variance V^) to remain 
undetected (which she can subsequently infer out of her esti- 
mate of Bob's quadrature measurement with arbitrary preci- 
sion). Once Bob receives these altered quantum states from 
Eve, he then measures both quadratures simultaneously 

Xf = [VeX^ - V(l - e)/2(X±.i + X%.2) 

+ + + giVl^eX^ (45) 
+ V^{X%,, + X%,^) + iV±2)^/2]y2 

This has a corresponding variance of 



VE = + - [2 + V,%, + V,%, 



V<K%,^V,%,)]/{4e-4) 



(46) 



We are now in a position to calculate Eve's conditional vari- 
ance V^i^£;2|B th^^ entanglement feed-forward attack, as a 
function of the beamsplitter transmission e. Once we have cal- 
culated this conditional variance we can then proceed as be- 
fore to determine the secret key rate. The conditional variance 
in this case will be a tripartite conditional variance defined as 



^El,E2\B 



(47) 



as we need to accommodate both of Eve's measurements in 
her estimate of Bob's quadrature measurements. Minimizing 
the two gains, we have 



E1,E2\B 



± '^El{^B^E2)'^ + ^E2{^B^El)'^ 



VirV^^-i^EA)' 
2{X^X^^){X^X^2){X^^X^2) 



(48) 



The above equation is a function of the two channel transmis- 
sions T] and e. To calculate one in terms of the other we need 
to consider how much information Eve is allowed to have be- 
fore she is detected by Alice and Bob. This is related by the 
following inequality 



- 2V^(2 + l^±,i+y42 (49) 
+ r?(2 + e(T/4i + F42))))/2(l-e) 
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where the left hand side is the amount of noise for an arbi- 
trary quantum channel. This noise must be greater than or 
equal to the total noise Eve has put onto the channel (as can 
be seen from Eq. (l45l). We numerically minimize V^^^^^^ 
for all e between emin and Cmax- Alice's conditional variance 
remains the same as before (i.e. Eq.(|231) as Eve has applied 
the correct gain. Now that we have Eve's and Alice's condi- 
tional variances we can use Eq.dTsl to numerically calculate 
the secret key rate. We find that the secret key rate for the en- 
tanglement feed-forward attack is the same as the secret key 
rate for the coherent feed-forward attack. 

In Fig. |2| we plot both the entanglement feed-forward at- 
tack and the coherent feed-forward attack (both the same top 
solid line). We conjecture that this higher bound is in fact 
the optimal bound for the no- switching protocol against indi- 
vidual attacks. In principle the best Eve can do is to optimally 
clone the states she intercepted from Alice and then send these 
cloned copies back onto Bob - which is exactly what the co- 
herent feed-forward attack does. Also by giving Eve more 
resources, such as entanglement, does not in any way give her 
an information advantage. This suggests we have found an 
optimal information bound. 



IV. BB84 AND THE NO-SWITCHING PROTOCOL 

As we have seen, the no-switching protocol works success- 
fully in the continuous variable regime using coherent states. 
It eliminates the need to randomly switch bases resulting in 
simplicity and higher information rates. We now ask the ques- 
tion: can the no- switching protocol be applied to the discrete 
variable regime and give the same benefits? To determine if 
this happens we consider an equivalent no- switching protocol 
for single photon states. This involves introducing a quan- 
tum cloning machine in Bob's station that allows him to im- 
perfectly clone (due to the no-cloning theorem |4]) what Al- 
ice has sent into two sets of copies. Bob can then measure 
both polarization bases simultaneously. This cloning machine 
will negate the need for Bob to randomly switch measurement 
bases. As a note, there have been other discrete variable pro- 
posals that do not rely on the random switching of measure- 
ment bases but rather the random switching of state manipu- 
lation, such as the "ping pong" protocol |36]. 



A. How the No-Switching Protocol for BB84 Works 

Alice sends a random ensemble of linearly polarized pho- 
tons to Bob. These photons are from a set of 4 possible po- 
larizations: horizontal (H) = |0), vertical (V) = |1), diagonal 
(D)= (|0) + |l))/72 and anti-diagonal (A) = (|0) - |l))/y2. 
Bob then uses a quantum cloning machine fs?] that takes one 
input state and outputs two identical clones. Bob can there- 
fore measure the first set of clones with the rectilinear bases 
and the other set with the diagonal bases. This guarantees that 
Bob always measures in the correct basis. The classical steps 
of reconciliation and privacy amplification follows. Figure |4| 
gives an illustration of the protocol. 
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H 
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Bob's Quantum Cloner 




(c) 



H/V 



D/A 



FIG. 4: The steps of the BE 84 scheme using the no-switching pro- 
tocol, (a) Alice sends to Bob a random ensemble of photons chosen 
from 4 possible polarizations, (b) Bob clones the incoming photons 
from Alice using a universal quantum cloning machine. This pro- 
duces the two clones 62 and 63- (c) Bob then measures one clone in 
the horizontal/vertical basis (H/V) and the other clone in the diago- 
nal/antidiagonal (D/A) basis. After communicating classically with 
Alice, Bob can then discard those times where he used the wrong 
basis. 



B. Bob's Quantum Cloning Machine 

We assume that Bob has a universal quantum cloning ma- 
chine at his station. This enables him to clone with a max- 
imum fidelity of 5/6 or ^ 83% of the original input state. 
The universal quantum cloning machine is state independent 
so will copy any input state with the same fidelity. Therefore 
it is suited to QKD as there is no prior knowledge of which of 
the four polarization states Alice has sent. 

To illustrate how the universal quantum cloner works we 
suppose that Bob wants to copy an arbitrary pure state = 
a\0) -\- (3\1) (this pure state corresponds to any one of the four 
photon polarizations). In our protocol Bob's inputs a given 
qubit bi into his cloning machine which outputs the identical 
clones 62 and 63. Here the state of the cloning machine is 
given by \C)b- Bob wants to copy the bases |0) and |1) of 
the arbitrary pure state. This initial preparation by Bob of his 
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cloning machine is given by 

|0)|0)|C)5 (50) 
|1)|0)|C)5 (51) 

where |0) is the blank state (e.g. the blank paper in copying 
machines) that is used to make the clones with. The resulting 
output of the cloning machine in Eqs. (150151ft is given by 1 35] 

/f|oo)IT) + /^l+)U) (52) 

where 1+) = (|10)) + |01))/V2 and | T) and | j) represent the 
output states of the quantum cloning machine. The resulting 
clones are identical, with each being of worse quality than the 
original qubit that Bob used as the input state. We are then 
able to perform a partial trace over the cloning machine states 
which allows us to look at any subsystem of the original den- 
sity operator. After performing a partial trace over the cloning 
machines we are left with a density operator describing the 
two output clones p^'^l^ • To find the density operator of either 
of the two clones individually, we can perform a partial trace 
over either of the two clones. The resulting reduced density 
operator can then be written as 

Pbf = (54) 

where {ipi) = a\0) ^ (3\1) and {1^2) = (3\0) - a\l). Eq.lEl is 
equal to the other density operator p^^^ due to the symmetry 
of the system. Eq. SSAi tells us that the clones comprise of 
5 /6 of the original input state and 1 /6 of the errors of the uni- 
versal quantum cloning machine. Therefore by having these 
clones of the original states sent by Alice, Bob can abandon 
switching and measure both bases at the same time. 

C. Information Rate 

Finally to determine whether the no- switching protocol 
works in the BB84 case we again need to consider informa- 
tion rates. Unlike the continuous variable information rates 
we previously used, we now need to use a (discrete) binary 
symmetric channel given by L3Q»1 

IaB = 1 + Pe^Og2Pe + (1 - Pe)log2(l - Pe) (55) 

where Pe is the error probability between Alice and Bob's 
mutual information. In the normal switching BB84 protocol 
(where we neglect Eve for the moment), Alice and Bob have 
an error probability of 25%. However after key sifting,where 



they discard incorrect basis measurements, they have zero er- 
ror probability leading to Iab = 1 bits/signal. But in actual 
fact Iab =0.5 bits/signal as Alice and Bob have, on aver- 
age, thrown away half of their original data in the classical 
communication step. 

D. To Switch Or Not To Switch 

In our no-switching protocol for the BB84 protocol we have 
an error probability of 1/6 or ^ 17% (from Bob's cloning 
machine), compared with an error rate of zero for the BB84 
protocol, after Alice and Bob discard the results for the in- 
correct measurement basis. Substituting this 17% error into 
EQ.(l55b gives an information rate of Iab =0.35 bits/signal. 
This information rate is slower than the Iab = 0.5 bits/signal 
for the BB84 protocol and thus it is more beneficial to use the 
original BB84 scheme. It is important to note that the 17% 
error is from Bob's station and not the quantum channel (i.e. 
not from Eve's tampering). Normally an error rate of 17% 
from the quantum channel is too high and would mean that 
Bob and Alice would not be able to distill a secure key. In 
our case, before Bob starts cloning, he and Alice can test the 
quantum channel for eavesdropping and provided it is below 
a safe threshold. Bob can continue cloning. In any event ran- 
domly switching the measurement bases when using discrete 
variable QKD gives a higher information rate than using the 
no- switching protocol. 



V. CONCLUSION 

Quantum key distribution has long made use of the random 
switching of measurement bases to ensure the security of the 
protocol. We have shown that switching is not a necessary 
requirement for coherent state continuous variable quantum 
key distribution. This was demonstrated via the no- switching 
protocol. The no- switching protocol gives higher information 
rates than protocols that use switching and also offers a sim- 
pler experimental setup. 

We investigated a physical implementation of the eaves- 
dropping scheme in the form of an entangling feed-forward 
attack. We showed that this attack was no more effective than 
a simpler coherent feed-forward attack that did not use entan- 
glement. We then conjectured that the coherent feed-forward 
attack was the optimal attack assuming individual Gaussian 
attacks. 

Finally we have shown that there is no advantage by apply- 
ing the no-switching protocol to the original BB84 protocol 
which employs single photon states. This is an interesting re- 
sult as it highlights the differences between QKD with single 
photon states compared to continuous variables. 

We would like to thank T. Williams and D. Pulford for use- 
ful discussions, and the financial support of the Australian Re- 
search Council and the Australian Department of Defence. 
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